4 ms·

I thought it was the teen's mother, who may be an attorney

joshstrange 8y ago
Yeah, I read it as the mother as well. And it talks about how she got a developer account to try to contact them? I guess maybe I understand that, somewhat? I don't know, it just feels like yeah they tried a lot of ways to contact apple but maybe not the right ones. I mean look: > Thompson provided emails to NBC News that showed her efforts to contact Apple, including an Apple representative who directed her to the company's "bug reporter" program and bug bounty program. Apple told her to look at the bounty program but the article doesn't say she followed up so I'm guessing she didn't. Regular customer service aren't equipped to deal security holes/bugs so I would expect this response. So yeah... I mean this whole article is about all the things she tried and how they didn't work but she didn't really try any of the right ways. The FIRST google result for "report ios security hole" is a link to Apple with the title "Contact Apple About Security Issues" [0] with the line: > To report security or privacy issues that affect Apple products or web servers, please contact product-security@apple.com. [0] https://support.apple.com/en-us/HT201220 https://support.apple.com/en-us/HT201220
- jrochkind1 8y ago
  The NYT article (https://www.nytimes.com/2019/01/29/technology/facetime-glitch-apple.html https://www.nytimes.com/2019/01/29/technology/facetime-glitc...) says: > His mother, Michele Thompson, sent a video of the hack to Apple the next day, warning the company of a “major security flaw” that exposed millions of iPhone users to eavesdropping. When she didn’t hear from Apple Support, she exhausted every other avenue she could, including emailing and faxing Apple’s security team, and posting to Twitter and Facebook. On Friday, Apple’s product security team encouraged Ms. Thompson, a lawyer, to set up a developer account to send a formal bug report
  - joshstrange 8y ago
    Dear god... Come on Apple, if that's all true that's pretty stupid/shitty of Apple. I guess maybe anyone filling bug bounty reports probably has a developer account so it's not a big deal? Also it's not clear if they mean a paid account or a free one. I'm guessing they just needed a way to let her submit the issue and open a dialog via their existing tools and workflows but maybe I'm being too generous to Apple.
    - jrochkind1 8y ago
      I mean, I'm sure that's what they were thinking. The fact remains that they have no suitable process for a non-developer to give them a vulnerability report that they pay attention to. She seems to have tried really hard, without having the background to know the 'right' way. You gotta have a way for people who don't know the 'right' way to submit and have it get somewhere, right? Without having to try really hard. They're doing you a favor. > To report security or privacy issues that affect Apple products or web servers, please contact product-security@apple.com You think "emailing apple's security team", which the NYT says she did, was emailing that address? I'm guessing it was, and apparently it didn't actually result in anyone paying attention. The email address they advertise as being the place to report security issues.... If they actually want/need people to create developer accounts and use a tool there, maybe they should say that and not give an email address apparently nobody pays attention to...

Yeah, I read it as the mother as well. And it talks about how she got a developer account to try to contact them? I guess maybe I understand that, somewhat? I don't know, it just feels like yeah they tried a lot of ways to contact apple but maybe not the right ones. I mean look: > Thompson provided emails to NBC News that showed her efforts to contact Apple, including an Apple representative who directed her to the company's "bug reporter" program and bug bounty program. Apple told her to look at the bounty program but the article doesn't say she followed up so I'm guessing she didn't. Regular customer service aren't equipped to deal security holes/bugs so I would expect this response. So yeah... I mean this whole article is about all the things she tried and how they didn't work but she didn't really try any of the right ways. The FIRST google result for "report ios security hole" is a link to Apple with the title "Contact Apple About Security Issues" [0] with the line: > To report security or privacy issues that affect Apple products or web servers, please contact product-security@apple.com. [0] https://support.apple.com/en-us/HT201220 https://support.apple.com/en-us/HT201220

jrochkind1 8y ago
The NYT article (https://www.nytimes.com/2019/01/29/technology/facetime-glitch-apple.html https://www.nytimes.com/2019/01/29/technology/facetime-glitc...) says: > His mother, Michele Thompson, sent a video of the hack to Apple the next day, warning the company of a “major security flaw” that exposed millions of iPhone users to eavesdropping. When she didn’t hear from Apple Support, she exhausted every other avenue she could, including emailing and faxing Apple’s security team, and posting to Twitter and Facebook. On Friday, Apple’s product security team encouraged Ms. Thompson, a lawyer, to set up a developer account to send a formal bug report
- joshstrange 8y ago
  Dear god... Come on Apple, if that's all true that's pretty stupid/shitty of Apple. I guess maybe anyone filling bug bounty reports probably has a developer account so it's not a big deal? Also it's not clear if they mean a paid account or a free one. I'm guessing they just needed a way to let her submit the issue and open a dialog via their existing tools and workflows but maybe I'm being too generous to Apple.
  - jrochkind1 8y ago
    I mean, I'm sure that's what they were thinking. The fact remains that they have no suitable process for a non-developer to give them a vulnerability report that they pay attention to. She seems to have tried really hard, without having the background to know the 'right' way. You gotta have a way for people who don't know the 'right' way to submit and have it get somewhere, right? Without having to try really hard. They're doing you a favor. > To report security or privacy issues that affect Apple products or web servers, please contact product-security@apple.com You think "emailing apple's security team", which the NYT says she did, was emailing that address? I'm guessing it was, and apparently it didn't actually result in anyone paying attention. The email address they advertise as being the place to report security issues.... If they actually want/need people to create developer accounts and use a tool there, maybe they should say that and not give an email address apparently nobody pays attention to...